NVD

Id
20411  
Name
CVE-2016-4979  
Description
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-07-06  
Modified Date
2016-11-28  
Seq
2016-4979  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
111560 20411 CVE-2016-4979 http://httpd.apache.org/security/vulnerabilities_24.html  View
111561 20411 CVE-2016-4979 http://packetstormsecurity.com/files/137771/Apache-2.4.20-X509-Authentication-Bypass.html  View
111562 20411 CVE-2016-4979 20160706 CVE-2016-4979: HTTPD webserver - X509 Client certificate based authentication can be bypassed when HTTP/2 is used [vs]  View
111563 20411 CVE-2016-4979 http://www.apache.org/dist/httpd/CHANGES_2.4  View
111564 20411 CVE-2016-4979 [oss-security] 20160705 CVE-2016-4979: HTTPD webserver - X509 Client certificate based authentication can be bypassed when HTTP/2 is used [vs]  View
111565 20411 CVE-2016-4979 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
111566 20411 CVE-2016-4979 http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html  View
111567 20411 CVE-2016-4979 91566  View
111568 20411 CVE-2016-4979 1036225  View
111569 20411 CVE-2016-4979 RHSA-2016:1420  View
111570 20411 CVE-2016-4979 https://github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2665 JVNDB-2016-003438 Apache HTTPD の HTTP/2 通信における X.509 クライアント証明書の認証処理の問題 Apache HTTPD では、HTTP/2 に対応するモジュール mod_http2 が、バージョン 2.4.17 から提供されています。mod_http2 は実験的なものであり、デフォルトではコンパイルされず、また、設定ファイルの初期設定では HTTP/1.1 のみが有効になっています。 CVE-2016-4979 91485 CVE-2016-4979 20411 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003438.html 2016-07-05 2016-11-22 View